Lucene search

RedhatVULNRICHMENT:CVE-2023-25586

HistorySep 14, 2023 - 8:49 p.m.

CVE-2023-25586 Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized

2023-09-1420:49:15

CWE-457

redhat

github.com

binutils

logic fail

uninitialized variable

crash

denial of service

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.3

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.

References

access.redhat.com/security/cve/CVE-2023-25586

bugzilla.redhat.com/show_bug.cgi?id=2167502

security.netapp.com/advisory/ntap-20231103-0003/

sourceware.org/bugzilla/show_bug.cgi?id=29855

sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5830876a0cca17bef3b2d54908928e72cca53502

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.3

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-25586